HUhuntress
SIEM

List Misconfigured SIEM Log Sources

Changed on

Shows the misconfigured SIEM log sources associated with an account. For example, Windows endpoints whose audit policy was overwritten by a Group Policy.

This endpoint requires a user-based API key with the appropriate permissions to access this endpoint.

get/v1/siem/log_sources/misconfigured

Request

  • Base URL
    https://api.huntress.io
  • URL
    https://api.huntress.io/v1/siem/log_sources/misconfigured
  • Auth
    basic (a scheme the document does not define)

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

organization_idinteger

Filter by organization ID within Huntress account.

Response

List Misconfigured SIEM Log Sources

Example response

{
  "misconfigured_log_sources": [
    {
      "agent_id": 157,
      "hostname": "DC01",
      "organization": {
        "id": 1234,
        "name": "ExampleCo"
      },
      "status": "unresolved",
      "misconfigured_policies": [
        {
          "category": "System",
          "name": "Audit Security State Change",
          "success": true,
          "failure": false
        }
      ]
    }
  ]
}

Changes